fix(backend): stage the tenant allowlist, correct what the flags do

Sets UNATTENDED_ENABLED_TENANTS and SAFE_WRITE_REQUIRED_TENANTS to
["metamind"] for Phase 3, and fixes the documentation around them,
which was wrong in three places.

SAFE_WRITE_REQUIRED_TENANTS is NOT the safe-write control. Its check
sits on the legacy command path, reached only when the caller omits
`understudy-command-contract: 2` AND the extension is protocol-1.
@understudy/connector has sent that header unconditionally since
0.5.0, so it cannot fire for a consumer on a current connector. The
protection it is named for is already unconditional in dispatchV2,
which refuses a protocol-1 write with the identical 426 for every
tenant. Recording its silence as an exercised safety control would
have enshrined a no-op in an evidence-gated rollout.

README.md required the allowlist to stay empty until acceptance
passed. The acceptance suite creates unattended sessions, so it can
never pass against an empty allowlist — the requirement was
unsatisfiable. apps/backend/README.md sanctioned ["*"] after rollout,
which the runbook rejects and which admits every tenant holding a
caller token.

stub-consumer.mjs posted `{}` to /v1/sessions, which is an UNATTENDED
request that 400s on the schema. It has not been able to verify the
attended path since attended creation became "no body", so it must
not be reached for as a regression check.

Also records for Phase 4 that the sweep's quarantine gate keys on
"understudy answered", not on refusal-ness — so a persistent 404 or
426 changes no state for 24 hours and then starts abandoning leases.

Author: gcharang

README.md

@@ -78,7 +78,7 @@ The Release workflow publishes the promoted versions with npm provenance. It rej
 
 Do not merge `master` back into `dev`. `NPM_TOKEN` needs publish access to the `@understudy` scope.
 
-Backend deployment remains a separate Wrangler operation. Keep `UNATTENDED_ENABLED_TENANTS=[]` until the canary extension passes the production acceptance suite. Follow the [unattended production rollout runbook](docs/unattended-production-rollout.md) for deployment order, evidence gates, and rollback.
+Backend deployment remains a separate Wrangler operation. Keep `UNATTENDED_ENABLED_TENANTS=[]` until the canary device is enrolled and reporting protocol 2, then enable it for that tenant by name — the acceptance suite creates unattended sessions, so it cannot run while the allowlist is empty. Named tenants only, never `"*"`. Follow the [unattended production rollout runbook](docs/unattended-production-rollout.md) for deployment order, evidence gates, and rollback.
 
 ## Preserve attended proof history
 

apps/backend/README.md

@@ -97,13 +97,19 @@ Copy `.dev.vars.example` to `.dev.vars` for local development. Never commit `.de
 
 Non-secret Wrangler variables include:
 
-| Variable | Default | Purpose |
+| Variable | Shipped value | Purpose |
 |---|---|---|
-| `UNATTENDED_ENABLED_TENANTS` | `[]` | Tenant allowlist for new unattended leases |
-| `SAFE_WRITE_REQUIRED_TENANTS` | `[]` | Tenant allowlist that rejects protocol-1 writes |
+| `UNATTENDED_ENABLED_TENANTS` | `["metamind"]` | Tenant allowlist for new unattended leases |
+| `SAFE_WRITE_REQUIRED_TENANTS` | `["metamind"]` | Legacy-path downgrade guard (see below) |
 | `QUOTA_POLICY` | Built-in JSON | Exact SQLite quota configuration |
 
-Use `["*"]` only after the protocol-2 extension rollout completes. Keep unattended creation disabled during the initial backend deployment.
+Both allowlists start at `[]` and are set per tenant during rollout; `wrangler.jsonc` is authoritative for what is deployed.
+
+Never use `["*"]` for either allowlist. `enabledForTenant` honours it, so a wildcard admits every tenant holding a caller token — the blast radius the named allowlist exists to bound. Wildcard enablement is a rejected option in the [rollout runbook](../../docs/unattended-production-rollout.md); onboard tenants by name, one at a time.
+
+Keep unattended creation disabled during the initial backend deployment. Enable it for a named tenant once that tenant's canary device is enrolled and reporting protocol 2 — the Chromium acceptance suite creates unattended sessions and cannot run against an empty allowlist.
+
+`SAFE_WRITE_REQUIRED_TENANTS` is a downgrade guard, not the safe-write control: its check is on the legacy command path, reached only when a caller omits `understudy-command-contract: 2` *and* the extension is protocol-1. `@understudy/connector` has sent that header unconditionally since 0.5.0. Protocol-1 writes are already refused for every tenant by `dispatchV2`, flag or no flag.
 
 The default exact quotas are:
 

apps/backend/scripts/stub-consumer.mjs

@@ -65,14 +65,18 @@ function wsBase(httpBase) {
   return httpBase.replace(/^http/, "ws");
 }
 
+// `body === undefined` sends NO body, which is how attended creation is
+// discriminated (see the "Attended creation is defined as no body" comment in
+// src/index.ts). Sending `{}` instead makes the request UNATTENDED and it fails
+// the unattended schema with a 400 before any flag is consulted.
 async function postJson(path, body) {
   const res = await fetch(`${BASE_URL}${path}`, {
     method: "POST",
     headers: {
-      "Content-Type": "application/json",
+      ...(body === undefined ? {} : { "Content-Type": "application/json" }),
       Authorization: `Bearer ${CALLER_TOKEN}`,
     },
-    body: JSON.stringify(body),
+    ...(body === undefined ? {} : { body: JSON.stringify(body) }),
   });
   const text = await res.text();
   let json;
@@ -134,7 +138,7 @@ async function main() {
   console.log("understudy stub consumer - M3 runbook harness");
   console.log(`BASE_URL=${BASE_URL}`);
 
-  const { sessionId } = await postJson("/v1/sessions", {});
+  const { sessionId } = await postJson("/v1/sessions");
   console.log(`\nsession opened: ${sessionId}`);
 
   const wsUrl = `${wsBase(BASE_URL)}/agents/session/${sessionId}?token=${EXTENSION_TOKEN}`;

apps/backend/wrangler.jsonc

@@ -91,8 +91,21 @@
   },
   "vars": {
     "QUOTA_POLICY": "{\"sessionCreatesPerActorMinute\":10,\"commandsPerSessionMinute\":120,\"commandsPerTenantMinute\":600,\"credentialFillsPerActorMinute\":30,\"deviceTicketsPerDeviceMinute\":30,\"sessionCommandCap\":10000}",
-    "UNATTENDED_ENABLED_TENANTS": "[]",
-    "SAFE_WRITE_REQUIRED_TENANTS": "[]"
+    // Gates ONLY the unattended create branch in src/index.ts; a request with an
+    // empty body returns from the attended branch above that gate, so attended
+    // callers never reach it. This is the live blast-radius control for
+    // unattended traffic: named tenants only, NEVER "*" — enabledForTenant
+    // honours "*" and it would admit every tenant that holds a caller token.
+    "UNATTENDED_ENABLED_TENANTS": "[\"metamind\"]",
+    // A downgrade guard, NOT the safe-write control. Its check in src/index.ts
+    // sits on the legacy command path, reached only when the CALLER omits
+    // `understudy-command-contract: 2` AND the extension is protocol-1.
+    // @understudy/connector has sent that header unconditionally since 0.5.0, so
+    // this never fires for a consumer on a current connector — it guards a caller
+    // on an older one, or a hand-rolled POST. The protection it is named for is
+    // already unconditional for every tenant: dispatchV2 in src/session.ts
+    // refuses a non-dryRun write from a protocol-1 extension with the same 426.
+    "SAFE_WRITE_REQUIRED_TENANTS": "[\"metamind\"]"
   },
   "analytics_engine_datasets": [
     {